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Status of This Memo 
This memo provides information for the Internet community. It does 
not specify an Internet standard. Distribution of this memo is 
unlimited. 
Abstract 


This document provides a set of guidelines for the administration and 
operation of public Network Information Center (NIC) databases. The 
purpose is to formalize procedures for the responsible handling of 
the personal and organizational information maintained by NICs in 
publically accessible databases, and to improve the accuracy and 
accessibility of such data where appropriate. 


Acknowledgments 


This document is based upon the work of the Network Information 
Services Infrastructure (NISI) working group in the User Services 
Area of the IETF. Thanks are due to the members of this working 
group who contributed ideas and comments, especially to Glee Cady 
(University of Michigan) for her significant contributions. Special 
thanks are also extended to Steve Crocker (TIS) for his guidance in 
this area. Due to the natural overlap between NIC databases and 
public user directories, this document also references concepts 
contained in the North American Directory Forum’s (NADF) "User Bill 
of Rights for Entries and Listings in the Public Directory" (RFC 
1295). 


1. Purpose 


The purpose of this document is to consider the privacy and accuracy 
issues that result from many NIC databases being publicly accessible. 
This document considers only generic concerns about such systems; it 
intentionally does not make recommendations for specific databases on 
the Internet. Clearly, it is the responsibility of each NIC to 
determine what procedures should apply for each of its databases. 

The document discusses the obligations a NIC that maintains such a 
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database has towards those about whom data appears in the database. 
These obligations apply to database entries that contain information 
that is publically accessible to Internet users. 


2. Background and Organization 


In fulfilling the functions of a Network Information Center, each NIC 
needs to collect and distribute a variety of information about the 
network it serves. Much of the information handled by a NIC is 
"directory" information that provides pointers to people, 
organizations, and resources throughout a network. The use of 
publically accessible databases to disseminate such data is seen as 
beneficial to the Internet because it allows efficient information 
retrieval by users, Network Operation Centers (NOCs), and other NICs. 


This document is organized into two parts. The first part contains 
recommendations for preventing unauthorized disclosure of information 
in NIC databases. The second part recommends formal accuracy 
guidelines for NIC databases. 


3. NIC Database Privacy 


The existence of publically accessible databases brings up a number 
of significant questions regarding controls over the gathering and 
distribution of the data. It is important that these concerns are 
addressed prior to the wide-scale deployment of a public NIC database 
or a NIC risks having to retrofit an established system to formal 
guidelines regarding such controls when they are finally available. 


For each publically accessible database that a NIC manages, the NIC 
needs to provide a clear statement of the purpose of the database, 
the types of information it contains, and the privacy policy that 


applies to the information stored within it. In general, this policy 
should inform people or organizations listed in the database of the 
content and purpose of their database entries. Specifically, the 


privacy policy should: 


1) Describe why the NIC needs the information and how it will use 
the information. 


2) List of all the information being stored in an entry. 


3) Detail which information will be made available outside of the 
NIC, to whom it will be made available, and for what purpose. 


4) Provide for notification of any person or organization added 
to the database at the request of a third party. 
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5) Explain how to have the information changed or updated. 


6) Explain how to get information removed from the database, 
including any references to one’s information in another’s 
database entry. 


7) Explain the consequences of removing information from the 
database and of failing to provide all or part of the 
information a NIC requests. 


The privacy policy enables people to make informed decisions 
regarding which information to supply for a given NIC database. Any 
information supplied should treated in a manner consistent with the 
current privacy policy. If a NIC makes a database available in its 
entirety to another organization, the NIC should also provide that 
organization with a copy of the current privacy policy for the 
database. 


4. NIC Database Accuracy 


The value of any NIC database is dependent on the accuracy and 
timeliness of its contents. Any database not being maintained well 
can create major difficulties for those using it and for those people 
and organizations listed. 


For each publically accessible database that a NIC operates, the NIC 
should have a clear statement that describes the process that the NIC 
uses to maintain accuracy in the database. This statement could be 
combined with the privacy statement described above for sake of 
administrative convenience. 


The accuracy statement informs potential participants in the database 
of the precautions taken by the NIC to ensure accurate information. 
Any information supplied should be treated in a manner consistent 
with the current accuracy policy. If a NIC makes a database 
available in its entirety to another organization, the NIC should 
also provide that organization with a copy of the current accuracy 
policy for the database. 


The accuracy statement should: 
1) Allow an individual or organization access to its own 
database entry, including private fields, for the purpose 


of correcting errors. 


2) Allow an individual or organization to correct any errors 
that occur in its database entry. 
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Inform an individual or organization when information about 
them appears in an entry belonging to another party, so 
that the individual or organization can review that 
information and have the opportunity to submit corrections. 


Change information in an entry only at the request of or 
with the approval of the individual or organization 
about which the entry applies. 


Encourage an individual or organization to report any errors 
that occur in the database entries of others. 


Provide for a "date of last review" for each entry in the 
database; this would reflect the date that the entry was 


last checked by the owner for accuracy. 


Describe any and all practices used by the NIC to confirm 
data prior to inclusion in the database. 


State the data backup procedures in use for this database. 


5. Security Considerations 


This memo briefly considers the security aspects of information in 
NIC databases. This memo should revisited as security infrastructure 
becomes more developed in the Internet. 
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